CVE-2024-2608

Mozilla: Integer overflow could have led to out of bounds write

`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 6 more

CVE-2024-2607

Mozilla: JIT code failed to save return registers on Armv7-A

Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 6 more

CVE-2024-29944

Mozilla: Privileged JavaScript Execution via Event Handlers

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.

CVSS 3.1 · 8.4 High EPSS 4.7% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 5 more

CVE-2024-2611

Mozilla: Clickjacking vulnerability could have led to a user accidentally granting permissions

A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Thunderbird and 5 more

CVE-2024-3861

Mozilla: Potential use-after-free due to AlignedBuffer self-move

If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVSS 3.1 · 4.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Thunderbird and 5 more

CVE-2024-3859

Mozilla: Integer-overflow led to out-of-bounds-read in the OpenType sanitizer

On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Thunderbird and 5 more

CVE-2024-3857

Mozilla: Incorrect JITting of arguments led to use-after-free during garbage collection

The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Thunderbird and 5 more

CVE-2022-3094

An UPDATE message flood may cause named to exhaust all available memory

Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1.

CVSS 3.1 · 7.5 High EPSS 13.2% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux Rhel Eus

CVE-2024-3854

Mozilla: Out-of-bounds-read after mis-optimized switch statement

In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 4 more

CVE-2024-3302

Mozilla: Denial of Service using HTTP/2 CONTINUATION frames

There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 4 more

CVE-2024-3852

Mozilla: GetBoundName in the JIT returned the wrong object

GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 4 more

CVE-2024-9403

firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and Thunderbird 131

Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131 and Thunderbird < 131.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 5 more

CVE-2023-0394

kernel: NULL pointer dereference in rawv6_push_pending_frames

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2023-5679

Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution

A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Fedoraproject Isc Netapp and 1 more

Products

Fedora Bind Active Iq Unified Manager and 2 more

CVE-2024-1547

Mozilla: Alert dialog could have been spoofed on another site

Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Thunderbird and 5 more

CVE-2022-4285

binutils: NULL pointer dereference in _bfd_elf_get_symbol_version_string leads to segfault

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Redhat

Products

Fedora Binutils Enterprise Linux and 2 more

CVE-2024-4317

PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Enterprise Linux Rhel Eus

CVE-2024-1550

Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants

A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Thunderbird and 5 more

CVE-2024-5693

Mozilla: Cross-Origin Image leak via Offscreen Canvas

Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 4 more

CVE-2022-25881

http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Http-cache-semantics Project Redhat

Products

Http-cache-semantics Acm Enterprise Linux and 5 more